Data Security

Student data privacy and security are at the core of everything we build. From encryption and access control to compliance frameworks and audit logging, every layer of SchoolOpsAI is designed to keep your district's data protected, private, and under your control.

AICPA SOC 2 logo for service organizations

FERPA: School Official Role

Each district designates SchoolOpsAI as a school official with a legitimate educational interest under 34 CFR §99.31(a)(1)(i)(B), under the district's direct control and bound by a signed data sharing agreement. We access education records only as the district authorizes, and we do not use student data for advertising, marketing or any purpose unrelated to the services the district contracted for.

SOC 2® Type II Report

SchoolOpsAI completed a System and Organization Controls (SOC 2) Type II examination performed by Accorp Partners CPA LLC, an independent licensed CPA firm. The examination covered the Security, Availability, Processing Integrity, Confidentiality and Privacy trust services criteria for the period June 1, 2026 through August 31, 2026. The full report is available to districts and prospective districts under a non-disclosure agreement.

COPPA: District-Directed Processing

SchoolOpsAI does not collect personal information directly from students. Student data reaches us only from systems the district already operates, and our data sharing agreement commits us to COPPA alongside FERPA, SOPIPA and PPRA. Where information about children under 13 is processed, we act on the district's instructions and the district holds parental consent.

Encryption & Infrastructure

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Our infrastructure runs on AWS with VPC isolation, automated backups and multi-availability-zone redundancy.

Role-Based Access Control

Granular permissions ensure that superintendents, principals, teachers and staff only see the data they're authorized to access. Every action is logged for complete auditability.

Audit Logging

Every data access, modification and export is logged with full traceability. Administrators can review who accessed what data and when, supporting compliance audits.

Data Ownership

Districts retain full ownership of their data at all times. We never sell, share, or use student data for advertising. Data can be exported or deleted at any time upon request.